‘Stronger Internal Audit Function Needed,’ Says IIAM

Strong internal audit functions in Public Listed Companies contributes to good governance

Kuala Lumpur, 4 April 2017 – The Institute of Internal Audit Malaysia (IIAM) is urging Public Listed Companies (PLCs) to strengthen their internal audit functions for the benefit of the overall company’s health. As the governing body of internal auditors, IIAM is aiming to increase the awareness of the state of internal audit functions in PLCs and identify what is required to enable internal auditors to effectively provide assurance on the governance, risk and control systems in organisations.

Lucy Wong, President of the Institute of Internal Auditors Malaysia said: “The role of internal audit as a pillar of governance is not fully appreciated in organisations. Such an important aspect of a company’s health cannot simply be overlooked. Therefore, in 2016, IIAM commissioned Dr Grace Mui to conduct a study to construct the profile of internal audit functions and Audit Committees in Malaysian PLCs.”

Shedding Light on Internal Audit

The study was carried out over the period of a year, in which it utilised the annual reports of 785 Bursa Main Market listed companies to highlight four key takeaways that could help enhance the internal audit function, and three enhancements for Audit Committees in PLCs. According to Bursa Malaysia Securities Berhad (Bursa) Main Market Listing Requirements, PLCs must appoint audit committee (AC) members amongst its directors and establish an internal audit function. The purpose of the internal audit function is to serve as a pillar of governance by providing independent and objective assurance on the governance, risk and control (GRC) systems of the organisation.

Titled “Profile of the Internal Audit Function and Audit Committees in Malaysian Public-listed Companies”, the study covers a wide range of topics from preference for type of internal audit providers and professionalism, to gender and skillset diversity.

The study shows that overall, 54% of PLCs preferred to outsource their internal audit function while 46% preferred in-house internal audit function. Outsourcing is more prevalent in smaller sized company, where 87% preferred outsourced service providers (OSP)s. The factors which could have determined their choice are the costs of establishing and maintaining an in-house internal audit function and costs of engaging professionally qualified internal auditors. When selecting OSPs, PLCs needs to ensure that OSPs are independent and their staff have professional qualifications, and not only low costs.

Appointment of internal auditors with a diverse range of skills are required to ensure understanding of industry related matters

All industries engaged OSPs while specialised industries (Close-end funds, mining and Special Purpose Acquisition Companies) solely outsourced their internal audit function. Other than the traditional accounting based skills, different technical skill and expertise are required for different industries. The mix of skills required could have contributed to the outsourcing of the internal audit function. However, over and above the industry technical skillsets the International Professional Practices Framework (IPPF), needs to be applied to ensure that standards are followed and the results provide value to the organisation.

Ensuring that the Internal audit function is adequately resourced

Issues with internal audit also stem from the lack of resources to adequately cover the relevant scope. Out of the 785 annual reports, it was reported that 90% of PLCs that outsourced their internal audit functions paid RM100,000 or less in a year. The amounts incurred indicates that very junior staff or very few staff were in the audit team and a limited scope was covered. The low amounts is also a sign that the staff are not professional staff and may not have the experience and skillset to effectively carry out the work, thus less is spent. PLCs should consider the professional qualifications, certification and experience of their OSPs in relation to the scope of the work required to ensure adequate coverage of risk areas and reliable reports are issued.

Disclosing the professional qualifications and experience of Head Internal Audit and lead outsourced internal auditor

Another issue spotted was the disclosure of professional qualifications of the in-house Head of Internal Audit and Lead Auditor from OSPs. From the annual reports, the qualifications and backgrounds of both audit parties were not disclosed, straining the study process. In order to gain a clearer picture of the qualification of both parties to ensure that the audit function is executed effectively, disclosure of the qualifications of the Head Internal Audit and the leader of the outsourced Internal Auditor will provide better accountability towards the PLC.

Enhancing Audit Committees

Promotion of gender diversity on the Audit Committee

In the area of diversity, it was noted that out of the 785 companies, 92% of Audit Committee members are male. This clear majority showcases a male dominated Committee with the minimal inclusion of women. Women are highly recommended as the difference of views may provide different perspectives to Audit Committee. These views could provide different suggestions and approaches towards the the issues raised by the internal audit function. PLCs need to consider approaching women to increase the diversity of the Audit Committee.

Separation of Audit Committee Chair and Board Chair role to avoid impairment of independence.

Separation of the Audit Committee Chair from the Board Chair contributes to good governance in the decision making process. However, the study shows that roughly 7% of Audit Committee chairs were also board chairs. An individual carrying out both the roles can lead to impairment of the Board Chair to exercise independent judgement if the decision taken at the Audit Committee is different from that at the Board level. The difference in views could also cause frictions. Separation would allow decisions to be taken without judgement and bias.

The last key takeaways from Dr Mui’s research was that 41% of Audit Committee chairs did not have professional accounting qualifications. These professional qualifications are important to ensure that the AC Chair has the skills to lead and deliberate on financial matters as well as to oversee that end results reflect the understanding of the Audit Committee Chair. For PLCs to thrive in the current business environment, Audit Committee Chairs should possess professional accounting qualifications.

Wong added: “IIAM is able to advise PLCs on the above matters and provide professional training, guidelines as well as many more services to in-house internal audit function and OSPs. Under the IIAM banner, internal auditors will be equipped with the most updated information and skills to help PLCs achieve better governance, better results and overall better organisational health.

“IIAM is more than happy to extend our services to PLCs, and ACs to ensure the best for internal auditors because this will eventually aid in the strengthening of the internal audit function as well as the overall strength of the internal audit profession.”

For more information, the research paper will be made readily available for download on the IIAM website (http://www.iiam.com.my/) after IIAM’s Audit Committee Conference on 5 March 2017.